[Openswan Users] Hub-and-Spoke routing

Mike C smith.not.western at gmail.com
Mon Feb 25 07:45:08 EST 2013


I am trying to figure out if it is possible to perform a hub-and-spoke
ipsec setup where the hub can route traffic between spokes. I.e.
Situations where spokes are NAT'd but the Hub is not, so is reachable
by all. I'm trying to get A to reach C via B: A->B->C. Using openswan
2.6.36, linux with klips.

My attempts to do so locally have failed so far. I have:

Spoke A:, WAN
Hub     B:, WAN
Spoke C:, WAN

I created a VPN between the spokes and B using a /16 subnet so traffic
for C will be routed over the VPN:

A can ping B and B can ping A.
C can ping B and B can ping C.

I found the eroute list looked wrong on B (hub). Everything was going
via the second route. So changed it from (public IPs masked):

# /libexec/ipsec/eroute
0     ->    => tun0x1012 at
168    ->     => tun0x1001 at


# /libexec/ipsec/eroute
84     ->    => tun0x1012 at
1103     ->    => tun0x1001 at

When I try have A ping C, and run wireshark on C, I see no traffic. As
far as I can see, the eroute counters on B don't increment at all
whereas they did when doing direct A-B, C-B pings.

Routing table for B: dev ppp0  proto kernel  scope link  src dev ipsec0  scope link  src dev eth0  scope link  src dev ipsec0  scope link  src dev lo  scope link
default via dev ppp0  src

Any ideas as to what is wrong, or if I'm barking up the wrong tree? If
I'm on the wrong track, can you advise on possible alternatives that I
could look into?



More information about the Users mailing list